SW-215 — Require a regular package.json file for dev and test project discovery #397

Summary

The dev and test project resolvers use existsSync followed by readFileSync and do not inspect the package.json entry type. A directory or symlink can therefore be followed as if it were a project manifest. Define and enforce a regular-file policy before reading project metadata.

Workstream

• Workstream: WS-SECURITY
• Primary scope: src/dev/project.ts; src/testing/project.ts; tests/dev-project.test.ts; tests/test-project.test.ts
• Protected surface: No
• Priority: P1
• Difficulty: high
• Proposed points: 200

Acceptance Criteria

• Missing package.json remains distinguishable from invalid manifest entries.
• Directories, symlinks, and other non-regular entries are rejected before reading.
• Error messages do not reveal target paths or file contents.
• Tests cover regular files, directory entries, file symlinks, and dangling symlinks where supported.
• Dev and test use the same policy.

Dependencies

None.

Out of Scope

• Unrelated architecture or public command-contract changes.
• New runtime dependencies without maintainer approval.
• Mainnet deployment or remote template execution.

Definition of Done

• Acceptance criteria have deterministic regression coverage.
• Security and compatibility boundaries remain intact.
• Supported-platform CI passes.

Labels

• Stellar Wave (do not apply until activation is explicitly authorized)
• type: security
• area: security
• priority: P1
• difficulty: high
• points: 200
• workstream: security

Sequencing and scope note

Sequencing: implement after SW-214 (#396) so dev/test share the same bounded manifest read boundary.